Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 6398 Source: Windows SharePoint Services 3

The Execute method of job definition <job definition> threw an exception. More information is included below.

The request failed with HTTP status 400: Bad Request.
This problem is likely to occur for the SharePoint Timer service (OWSTimer.exe) in Microsoft Office SharePoint Server 2007. When this problem occurs for the SharePoint Timer service, tasks that are scheduled in SharePoint Server 2007 do not run. See ME958974 for a hotfix applicable to Microsoft Internet Information Services 6.0.

See ME946517 for a hotfix applicable to Microsoft Internet Information Services 6.0 and 7.0.
If the extended information is something like: “Retrieving the COM class factory for component with CLSID {629DA12E-9AD5-4FEC-B886-42C5982C5109} failed due to the following error: 80070005” and is accompanied by events in the System log with event ID 10016 from source DCOM then the issue is that the user account the spsearch service (Windows SharePoint Services Search Gathering Manager) runs under does not have local activation rights. This is resolved in the DCOM configuration manager.

1. Click Start, click Run, type dcomcnfg in the Open box, and then click OK.
2. Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config.
3. Right-click SPSearch, and then click Properties.
4. Click the Security tab.
5. Under Launch and Activation Permissions, click Edit.
6. In the Launch Permission dialog box, click Add.
7. In the Select Users, Computers, or Groups dialog box, type the domain user account that you specified as the Windows SharePoint Services 3.0 service account, click Check Names, and then click OK.
8. In the Permissions for UserName list, click to select the Allow check box that is next to Local Activation, and then click OK two times.

Credit for this solution goes to Steven Tapping, see the link to “SharePoint 2007 SPSearch Repeating Local Activation Error in Event Logs” for more information.
In my case, this error comes up while shutting down the SQL Services for backing up the Database. Restarting the services cleared the error.
Check the description of the event for a reference of "Attempted to read or write protected memory. This is often an indication that other memory is corrupt”. This links to a known .NET Framework 2.0 issue. You may find similar descriptions with events 7076 and 6842. A hotfix is available for this event; see ME923028 for more information.
Verify that "Accept Incoming Content Deployment Jobs" is selected in Content Deployment Settings.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.